February 14, 2023-Security Only Update for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Embedded 8.1 and Windows Server 2012 R2 (KB5022785)

Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.6.2 Microsoft .NET Framework 4.7 Microsoft .NET Framework 4.7.1 Microsoft .NET Framework 4.7.2 Microsoft .NET Framework 4.8

**Note:**Revised on Jun 20, 2023 to add resolution to known issue.

REMINDER

• As a reminder to advanced IT administrators, updates to .NET Framework 3.5 for Windows Embedded 8.1 and Windows Server 2012 R2 should only be applied on systems where .NET Framework 3.5 is present and enabled. Customers who attempt to pre-install updates to .NET Framework 3.5 to offline images that do not contain the .NET Framework 3.5 product enabled will expose these systems to failures to enable .NET Framework 3.5 after the systems are online. For more extensive information about deploying .NET Framework 3.5, see Microsoft .NET Framework 3.5 Deployment Considerations.
• If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Summary

CVE-2023-21808 - .NET Framework Remote Code Execution Vulnerability
This security update addresses a vulnerability in the MSDIA SDK where an untrusted pointer dereference can cause memory corruption, leading to a crash or remove code execution. For more information please see CVE-2023-21808. CVE-2023-21722 - .NET Framework Denial of Service Vulnerability
This security update addresses a vulnerability where the Visual Studio WMI Setup Provider Installer can be used by a low level, local attacker to corrupt local files that SYSTEM can writ to, leading to a potential denial of service. For more information please see CVE-2023-21722.

Known issues in this update

Additional information about this update

The following articles contain additional information about this update as it relates to individual product versions.

• 5022531 Description of the Security Only Update for .NET Framework 3.5 for Windows Embedded 8.1 and Windows Server 2012 R2 (KB5022531)
• 5022524 Description of the Security Only Update for .NET Framework 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows Embedded 8.1 and Windows Server 2012 R2 (KB5022524)
• 5022516 Description of the Security Only Update for .NET Framework 4.8 for Windows Embedded 8.1 and Windows Server 2012 R2 (KB5022516)

How to get this update

How to obtain help and support for this update

• Help for installing updates: Windows Update FAQ
• Protect yourself online and at home: Windows Security support
• Local support according to your country: International Support